CVE-2024-5693: firefox — Fix

Description

Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.

Is your site exposed to CVE-2024-5693?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness Type (CWE)

CWE-829 CWE-829

Affected Products

Vendor	Product	Versions
mozilla	firefox	< 115.12
mozilla	firefox	< 127.0
mozilla	thunderbird	< 115.12

References

Advisories & Patches

https://www.mozilla.org/security/advisories/mfsa2024-25/ https://www.mozilla.org/security/advisories/mfsa2024-26/ https://www.mozilla.org/security/advisories/mfsa2024-28/ https://www.mozilla.org/security/advisories/mfsa2024-25/ https://www.mozilla.org/security/advisories/mfsa2024-26/ https://www.mozilla.org/security/advisories/mfsa2024-28/

Other References

https://bugzilla.mozilla.org/show_bug.cgi?id=1891319 https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html https://bugzilla.mozilla.org/show_bug.cgi?id=1891319 https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html

Frequently Asked Questions

What is CVE-2024-5693? +

Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. It has a CVSS v3.1 base score of 6.1 (MEDIUM).

How severe is CVE-2024-5693? +

CVE-2024-5693 has a CVSS v3.1 score of 6.1 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-5693? +

CVE-2024-5693 affects products from mozilla, specifically: firefox, thunderbird. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-5693? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-45272

MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the …

CVE-2026-7373

Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control …

CVE-2025-34060

A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input …

CVE-2026-59864

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota plugin add` and `kiota plugin generate` (with …

CVE-2025-34074

An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled task functionality. …

CVE-2026-48124

Cursor is a code editor built for programming with AI. In versions prior to 3.0.0, the Cursor Desktop could execute …

CVE-2024-5693